发布时间: 2024年5月17日
修改时间: 2024年10月31日
In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations.
NVD | openEuler | |
---|---|---|
Confidentiality | None | |
Attack Vector | Local | |
CVSS评分 | N/A | 5.5 |
Attack Complexity | Low | |
Privileges Required | Low | |
Scope | Unchanged | |
Integrity | None | |
User Interaction | None | |
Availability | High |
公告名 | 概要 | 发布时间 |
---|---|---|
KylinSec-SA-2024-4777 | kernel security update | 2025年2月17日 |
KylinSec-SA-2024-4953 | kernel security update | 2025年2月28日 |
产品 | 包 | 状态 |
---|---|---|
KY3.4-4A | kernel | Fixed |
KY3.5.2 | kernel | Fixed |
KY3.4-5 | kernel | Fixed |
KY3.5.1 | kernel | Fixed |